Phil Ringnalda reported a possible way to spoof Install source with user:pass@host (CAN-2005-0590)

Impact

The GIF heap overflow could be triggered by a malicious GIF image that would end up executing arbitrary code with the rights of the user running Thunderbird. The other overflow issues, while not thought to be exploitable, would have the same impact. Furthermore, by setting up malicious websites and convincing users to follow untrusted links, attackers may leverage the spoofing issue to trick user into installing malicious extensions.